Fine-Grained Authorization for Secure RAG With OpenSearch
summary
A running on‑prem RAG proof of concept uses OpenSearch as the vector DB, a router that builds kNN queries, and OpenFGA to assert per‑user permissions so only authorized chunk IDs reach the LLM; ingestion uses an OpenSearch pipeline with chunking triggered by CFKA events from Seth object storage and results are filtered via post‑filter or efficient kNN filters to trade latency for strictness. The system preserves user auth context, supports multi‑index routing for scale, and successfully augments queries with two tested on‑prem LMs via keyser.
AI-written summary · about
chapters (7)
- 0:00Introduction
- 1:49OpenSearch for RAG
- 6:04LLM security challenges
- 8:38RAG access control
- 11:36Fine-grained authorization with OpenFGA
- 13:47Secure RAG architecture
- 15:37Q&A
related talks
34mImplementing an open-source RAG with OpenSearch
20mChallenges in Building RAG Systems (and Solutions Using OpenSearch)
37mBuilding advanced RAGs with Elasticsearch OpenSearch
21mA Brief Guide to Secure Agentic Knowledge Retrieval
30mFine-Grained Authorization: The Missing Piece in Agentic AI Security
42mIntegrating Graph Context With OpenSearch for Enhanced RAG Application Performance
57mFine-Grained Authorization: The Missing Piece in Agentic AI Security
22mOrchestrating Multimodal RAG With Agentic Workflows With OpenSearch